What it does
BP 15 04 is one of ISO's data-related liability exclusions for the BOP. ISO's 2025 program overview groups it with BP 15 06 as exclusionary endorsements addressing damages arising out of any access to or disclosure of confidential or personal material or information. The 12 23 edition followed an ISO filing of new, revised and withdrawn endorsements addressing cyber-related issues and data privacy.
Who needs it
Carriers attach it widely to make clear that data breach liability is not part of the BOP's general liability coverage. It affects any business that holds customer, patient, employee or payment card data.
Quoting and selling notes
- Explain the gap: a breach of customer data is not covered under the BOP liability section with this form attached.
- Offer cyber coverage: ISO's Information Security Protection endorsement (BP 15 07) where the carrier offers it, or a stand-alone cyber policy (ISO CY program or carrier forms).
- BP 15 06 is the narrower version that applies only to personal and advertising injury; ISO also has a separate exclusion for violation of laws addressing data privacy (BP 18 04).
